Slashdot Mirror

← Back to Stories (view on slashdot.org)

California Class Action Suit Sony Over Rootkit DRM

Posted by samzenpus on from the what-else dept.

carre4 writes "Lawyers in California have filed a class-action lawsuit against Sony and a second one may be filed today in New York. The lawsuit was filed Nov. 1 in Superior Court for the County of Los Angeles by Vernon, CA attorney Alan Himmelfarb. It asks the court to prevent Sony from selling additional CDs protected by the anti-piracy software, and seeks monetary damages for California consumers who purchased them. The suit alleges that Sony's software violates at least three California statutes, including the "Consumer Legal Remedies Act," which governs unfair and/or deceptive trade acts; and the "Consumer Protection against Computer Spyware Act," which prohibits -- among other things -- software that takes control over the user's computer or misrepresents the user's ability or right to uninstall the program. The suit also alleges that Sony's actions violate the California Unfair Competition law, which allows public prosecutors and private citizens to file lawsuits to protect businesses and consumers from unfair business practices. EFF has released a list of rootkit affected CD's and Slashdot user xtracto also has a list."

110 of 508 comments (clear)

  1. I understand the first two... by RandoX · · Score: 5, Insightful

    But how did Sony's actions prevent people from suing? Was there a clause in the EULA that prohibited it? Since they're getting their asses sued off anyway, can't the judge throw this one right out?

    1. Re:I understand the first two... by KitesWorld · · Score: 5, Informative

      From the EULA :

      NO SONY BMG PARTY SHALL BE LIABLE FOR ANY LOSS OR DAMAGE, EITHER DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL OR OTHERWISE, ARISING OUT OF THE BREACH OF ANY EXPRESS OR IMPLIED WARRANTY, TERM OR CONDITION, BREACH OF CONTRACT, NEGLIGENCE, STRICT LIABILITY MISREPRESENTATION, FAILURE OF ANY REMEDY TO ACHIEVE ITS ESSENTIAL PURPOSE OR ANY OTHER LEGAL THEORY ARISING OUT OF, OR RELATED TO, THIS EULA OR YOUR USE OF ANY OF THE LICENSED MATERIALS (SUCH DAMAGES INCLUDE, BUT ARE NOT LIMITED TO, LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF DATA, LOSS OF USE OF THE PRODUCT OR ANY ASSOCIATED EQUIPMENT, DOWN TIME AND USER'S TIME), EVEN IF THE SONY BMG PARTY CONCERNED HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN ANY CASE, THE ENTIRE LIABILITY OF THE SONY BMG PARTIES, COLLECTIVELY, UNDER THE PROVISIONS OF THIS EULA SHALL BE LIMITED TO FIVE US DOLLARS (US $5.00). SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF DIRECT, INDIRECT, INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CERTAIN INSTANCES, SO THE ABOVE EXCLUSION MAY NOT APPLY TO YOU. THIS ARTICLE WILL NOT APPLY ONLY WHEN AND TO THE EXTENT THAT APPLICABLE LAW SPECIFICALLY REQUIRES LIABILITY DESPITE THE FOREGOING DISCLAIMER, EXCLUSION AND LIMITATION.

      And this little bit too :
      Article 10. GOVERNING LAW AND WAIVER OF TRIAL BY JURY 1. THE VALIDITY, INTERPRETATION AND LEGAL EFFECT OF THIS EULA SHALL BE GOVERNED BY, AND CONSTRUED IN ACCORDANCE WITH, THE LAWS OF THE STATE OF NEW YORK APPLICABLE TO CONTRACTS ENTERED INTO AND PERFORMED ENTIRELY WITHIN THE STATE OF NEW YORK (WITHOUT GIVING EFFECT TO ANY CONFLICT OF LAW PRINCIPLES UNDER NEW YORK LAW). THE NEW YORK COURTS (STATE AND FEDERAL), SHALL HAVE SOLE JURISDICTION OF ANY CONTROVERSIES REGARDING THIS AGREEMENT; ANY ACTION OR OTHER PROCEEDING WHICH INVOLVES SUCH A CONTROVERSY SHALL BE BROUGHT IN THOSE COURTS IN NEW YORK COUNTY AND NOT ELSEWHERE. THE PARTIES WAIVE ANY AND ALL OBJECTIONS TO VENUE IN THOSE COURTS AND HEREBY SUBMIT TO THE JURISDICTION OF THOSE COURTS. 2. YOU HEREBY WAIVE ALL RIGHTS AND/OR ENTITLEMENT TO TRIAL BY JURY IN CONNECTION WITH ANY DISPUTE THAT ARISES OUT OF OR RELATES IN ANY WAY TO THIS EULA OR THE SOFTWARE.

      So yeah, they tried to get out of their corperate liabilities.

    2. Re:I understand the first two... by Skater · · Score: 5, Informative

      Yeah, but companies always put that in. Ever go to the hospital and sign a liability waiver saying you won't sue them if the doctor makes a mistake? Malpractice suits still happen (and are won) even though the patient signed that waiver.

      I believe the term is "exculpatory", and the way my legal environment professor explained it was this: "If clauses like that worked, we'd all be driving around with signs on the front of our cars that say, 'Not responsible if I hit you'." (IANAL, of course.)

    3. Re:I understand the first two... by canuck57 · · Score: 4, Insightful

      can't the judge throw this one right out?

      He probably could throw it out but I hope the opposite happens. Toss a big fine and bad publicity to Sony for this. DRM went too far with a root kit and two wrongs don't make a right. Sony is going to have to learn this. But the worst may yet come for Sony, I for one will no longer buy Sony products.

      And of all things, to remove the root kit you have to run an Active-X control from an untrusted site. Just what we in the security business tell people for good reason not to do.

      So I support dragging Sony through the mud on this.

    4. Re:I understand the first two... by MECC · · Score: 4, Informative

      I had a law prof once who pointed out that waivers from liability are very limited in their ability to protect from litigation. If Sony broke the law, they broke the law. No EULA will protect them from being hauled into court.

      --
      "We are all geniuses when we dream"
      - E.M. Cioran
    5. Re:I understand the first two... by Hinhule · · Score: 2

      But why are these texts always in CAPS? Makes it very hard to read.

    6. Re:I understand the first two... by jimbolauski · · Score: 2, Insightful

      Lawyers like to pile extra stuff on just in case they can convince the judge of wrong doing. The EULA has a clause that attempts to protect sony from their liability, but fortatnly most good lawyers can argue that the EULA was not disclosed before the purchase, so the EULA is just there to discourage/intimidate customers from suing sony. Sony better hope that this issue dosn't get put before a jury because it will be real easy to scare them into thinking sony was being malicious.

      --
      Knowledge = Power
      P= W/t
      t=Money
      Money = Work/Knowledge so the less you know the more you make
    7. Re:I understand the first two... by Raumkraut · · Score: 5, Funny

      I think you just answered your own question.

    8. Re:I understand the first two... by Libby+Liberal · · Score: 5, Informative

      IANAL, but I worked for one for more than seven years. I haven't the training or the interest to provide legal advice, but here we go:

      Exculpatory/Hold Harmless/Indemnity agreement is/are the correct term(s).

      Exculpatory agreements are those contracts that attempt to create a pretext of blamelessness when a party might otherwise be typically held liable for damages in the event of some sort of failing on their part.

      They're generally challenged at a state level and taken before the state supreme court. Generally speaking, the track record of such agreements is dismal. Wisconsin, for example, has recently heard some six or so cases involving exculpatory agreements, including the one provided along with Atkins. In each case, the court ruled that the agreements were unenforcable. Here's the Supreme Court's overturn of the trial court's finding of indemnity:

      http://www.gklaw.com/publication.cfm?publication_i d=360

      They're not always ruled unenforceable, but because they tend to be so overbroad, they're highly subject to being ruled that way. Generally speaking, this type of agreement is used mainly to frighten people away from lawsuits. The handful of people who will actually challenge them and the cost they create for a company is usually much smaller than if the company actually had to pay out when they did some harm.

      --
      I voted for Bob Dole once. That was the smartest thing I ever did since he lost.
    9. Re:I understand the first two... by pendor17 · · Score: 5, Insightful

      Isn't that (making it hard to read) exactly the point? I think that many companies write their EULA so that you don't WANT to read it, and writing in CAPS (which many people construe as "shouting") is certainly a "turn-off". In much the same way, many manufacturers setup their rebate programs so that you forget to send in the rebates in by the deadline. After all, this is capitalism - a corporation like Sony isn't looking out for YOU...

    10. Re:I understand the first two... by Shakrai · · Score: 3, Funny

      I believe the term is "exculpatory", and the way my legal environment professor explained it was this: "If clauses like that worked, we'd all be driving around with signs on the front of our cars that say, 'Not responsible if I hit you'." (IANAL, of course.)

      So what your telling me is that my bumper sticker that says "If you can read this I'm about to lock my brakes" won't shield me from legal liability?

      God damn it!

      --
      I want peace on earth and goodwill toward man.
      We are the United States Government! We don't do that sort of thing.
    11. Re:I understand the first two... by deroby · · Score: 3, Funny

      Such splendid use of the word "CAPITALism" =)

      --
      If there is one thing to be learned on slashdot, it has to be sarcasm.
    12. Re:I understand the first two... by Drachemorder · · Score: 3, Interesting
      If you have autorun on, the EULA pops up when you insert the CD. If you agree to it, the rootkit gets installed (along with all the other Sony audio player stuff and what not).

      This, of course, leaves open the question of what happens if you DON'T have autorun on, or you decline the EULA and play the CD via other means.

    13. Re:I understand the first two... by fireweaver · · Score: 2, Funny

      deroby (568773) wrote:

      "Such splendid use of the word "CAPITALism" =)"

      But what Sony has done might be called CRAPitalism.

    14. Re:I understand the first two... by timeOday · · Score: 4, Interesting
      That's right kids, you can't get away with murder simply by granting yourself the right to do so in some fine print legalize.

      I think it's foolish to let companies write (nearly) arbitrary contracts for public commerce. It's widely accepted that non-lawyers are unfit to interpret contracts (that why we make fun of people who ask legal questions on Slashdot), and yet the dozens of different contracts you can't go a day without consenting to are supposed to be binding. It's unworkable. I think everyday commerce with private individuals should be governed by a small, standardized set of contracts established by law. Then allow companies to select which they want for each product or service.

    15. Re:I understand the first two... by justin12345 · · Score: 4, Funny

      I once had to hack together a TOS/EULA for a small net company. I really wanted to stick "ALL YOUR BASE ARE BELONG TO US" in there but I chickened out. Its too bad, I later found out that that is something people do. From Blogger's TOS:

      (e) IF YOU HAVE READ THIS FAR THEN YOUR EYES PROBABLY HURT. ALL CAPS, WHAT WERE WE THINKING? HOWEVER, WE ARE NOT LIABLE FOR THIS OR ANY OTHER OCULAR MALADY.

      They have the balls I didn't.

      --
      Cool art gallery, if you're into that sort of thing.
    16. Re:I understand the first two... by Anonymous Coward · · Score: 2, Insightful

      But why do people put heavy desclaimers when giving legal opinion?

      IANAL, if you want legal advice etc. etc..

      I never heard anyone say I am not a computer scientist when they happily criticize code?

      I am not an american, is this an amercan law or something?

    17. Re:I understand the first two... by Libby+Liberal · · Score: 5, Informative

      When non-lawyers point out that they aren't lawyers, it's for the benefit of the reader so the reader doesn't mistake a layperson's opinion on a legal matter with expert legal advice. In other words, I'm saying above "I'm not an expert on this matter, so don't take what I say here and try to apply it in a court of law or you could be in serious trouble".

      Lawyers have to be careful online about giving out legal advice because of ethical standards, so they frequently disclaim their statements (whether it means anything or not) with "this does not constitute legal advice". Providing certain advice could be construed as creating an attorney-client relationship. At that point, you could also be automatically in breach of attorney-client privilege because you would be posting your new client's advice on a public forum.

      There's actually a significant amount of debate on the matter. By simply pointing out that you're not providing legal advice, does your advice become any less legal?

      Disclaiming is sort of like those statements at the bottom of corporate emails that say if you receive a message by mistake you're obligated to destroy it immediately. Well, of course you're not unless you have a contract with the company that says otherwise. If I get a private email from somebody with damaging corporate details, I'm in no way, shape, or form obligated to destroy it, and I'm entirely free to share it with other people so long as I'm not breaking other laws by doing so (e.g. - committing fraud, espionage, etc.).

      --
      I voted for Bob Dole once. That was the smartest thing I ever did since he lost.
    18. Re:I understand the first two... by Anonymous+Brave+Guy · · Score: 3, Informative
      But why do people put heavy desclaimers when giving legal opinion?

      Because in many jurisdictions, offering certain types of advice (typically legal, financial or medical) as if you're knowledgable on a subject, but without the professional qualifications, insurance etc. to match, can get you in a whole heap of trouble if the advice turns out to be wrong. There's nothing wrong with discussing these issues anywhere, AFAIK, as long as it's clear that it's a personal opinion and not professional advice.

      AIUI, the disclaimers are actually more relevant for those who are practising professionals. For example, if a lawyer gives some general legal advice randomly on the Internet, they probably wouldn't want it to be treated the same way as advice they gave in confidence to a client whose exact situation they knew. A couple of fairly regular Slashdotters have a sig that says something like "I am a lawyer, but I'm not your lawyer, and this is not my legal advice to you".

      Of course, the most important disclaimer is that if you get your legal advice from Slashdot, you probably deserve whatever consequences befall you anyway...

      --
      If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
    19. Re:I understand the first two... by n8ur · · Score: 2, Informative

      Some kinds of contract provisions (disclaimer of warranties under the Uniform Commercial Code, and the notices required by numerous consumer protection laws) are required by statute to be in "conspicuous" type. All caps is considered conspicious if the rest of the document is capitalized normally. So, that's why those "ALL OTHER WARRANTIES, EXPRESS OR IMPLIED..." provisions are done that way. (You'll often see those provisions in bold as well, just at add more conspicuousness.)

      However, if the whole document is in caps and the magic provision thus isn't differentiated from the rest of the text, then there's a pretty good argument that it's not "conspicuous," and there's a good chance a judge interested in the fine points of the law would find that clause unenforceable.

    20. Re:I understand the first two... by nahdude812 · · Score: 2, Informative

      Actually I'd like to also point out that the greater danger from fallen gravel is gravel that has bounced once or twice. Before the gravel hits the ground, it's traveling almost the same speed as the truck (and presumably a similar speed to your car), while once it's bounced off the ground once, it's lost a lot of momentum from the bounce (and spin from the bounce), as well as longer exposure to wind resistance.

      These factors give it a higher velocity relative to your car, making them more dangerous the longer it's been since they left the truck. Hence, if you were greatly concerned about damage from the gravel, you're less likely to encounter damage if you *are* tailgaiting the truck. Unless it's a very tall truck losing gravel at the top, in which case that may be similar in relative velocity, though most trucks will lose gravel 4-5 feet off the road (at the bottom of their flatbed, or the bottom of their dump truck's rear panel).

      --
      Slay a dragon... over lunch!
    21. Re:I understand the first two... by Tom · · Score: 2, Interesting

      I think everyday commerce with private individuals should be governed by a small, standardized set of contracts established by law.

      Come to Germany, we've got something close to that.

      The so-called AGB ("Allgemeine Geschäftsbedingungen", roughly meaning "general terms of doing business with us") are extremely common in Germany and regulate stuff like how to return stuff to claim warranty, how quickly to pay if you don't pay by cash or credit card, that the stuff remains property of the shop until paid in full, etc. etc.
      It's usually 1-2 pages of legalese in small print. And it's put up somewhere in the shop, linked from the websites, etc.

      But - that ain't the beauty. The beauty is that german courts have enforced a rule to forbid "surprising clauses". See, some companies tried to slip outrageous stuff in there, just the stuff you find in EULAs, or the like.
      The courts have simply declared these clauses null and void. Anything that you wouldn't by common sense expect to find in the AGB is basically forbidden to be there.

      Excellent measure. As a customer, I know I don't have to read the AGB unless I need to actually use them (i.e. return something, claim a refund, or check how long I can withhold payment before they want it back).

      --
      Assorted stuff I do sometimes: Lemuria.org
    22. Re:I understand the first two... by jazman_777 · · Score: 3, Informative
      I am not an american, is this an amercan law or something?

      It's because on /. we often assume the law should reflect our own common sense of how things should work. There is in reality no connection. Every day hundreds of disappointed litigants leave courts scratching their heads on how the law came up with such a screwy result against common sense and all decency.

      'IANAL' is a nod to the way things really work. 'IANAL' says, 'Here's my common sense, but it means nothing in a court of law.'

      --
      Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
    23. Re:I understand the first two... by Phroggy · · Score: 2, Insightful

      Actually I don't think you even need the bumper sticker. IIRC in PA (and probably other states), if you rear end someone you're at fault, unless you can manage to prove that the other car cut you off. You are responsible for keeping a safe distance between you and the car in front of you.

      As far as I know, this is correct.

      I've heard of people turning on their headlights (which also lights up the taillights) to scare the person behind them by making them think they're seeing brake lights, without actually slowing down. Personally I always drive with my headlights on, because it makes me more visible to other drivers (even during the day in good weather), and my brake lights are very sensitive (they come on as soon as my foot touches the brake pedal).

      However, when someone is following you that closely, the best thing you can do (assuming you're not already in the rightmost lane) is to maintain speed, turn on your right turn signal, wait for a safe opportunity to do so, and change lanes. Remember, it's not a race; you don't get a prize for crossing the finish line before the other guy. Other drivers are idiots - let them be idiots, and stay out of their way.

      Cool insightful geeky traffic stuff here

      --
      $x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
      $x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
    24. Re:I understand the first two... by timeOday · · Score: 3, Insightful
      If you agree to not hold someone responsible for anything that they do to you, well, you're a moron who practically deserves to get taken advantage of.
      I don't think this is true, and a lot hinges on it. The problem is that in today's world there's practically no way to know what you're "agreeing" to.

      First, you may never see the contract. Maybe you are tearing the shrinkwrap off a box of software with some disclaimers hidden somewhere inside. Maybe you're sitting down to use software installed by somebody else along time ago.

      Second, the contracts are too long and complicated. It would be impossible for a company to conduct business if every customer who came in to spend $20 had their own unique multiple-page legal document that had to be scrutinized and accepted by a company lawyer. Not because companies are lazy or stupid but because it's economically infeasible. Yet somehow that's what we demand of private individuals (with no legal training) in dealing with dozens of companies every week. It's simply not workable, and gives the upper hand to businesses which conduct all end-customer transactions under the same contract (their own).

      Third, even if you know all the jargon and have all the time in the world to read the contracts, you really can't interpret them without knowing the entire legal framework. Which parts are actually enforceable by law, and which are just wishful thinking by a company lawyer? Do you know all the applicable state regulations? How about for all 50 states, or do you never order things from another state?

      The enticing ideal of two parties with mutual understanding entering a contract simply isn't very applicable to the myriad of little transactions we carry out on a day to day basis, and yet we pretend it is. That's why its such a mess.

  2. Hell yeah! by Anonymous Coward · · Score: 3, Funny

    The man is sticking it to the man!

    1. Re:Hell yeah! by Dashing+Leech · · Score: 5, Funny
      "The man is sticking it to the man!"

      Not that there's anything wrong with that. (=

    2. Re:Hell yeah! by vivian · · Score: 5, Funny

      I can't believe how appropriate some of the song titles are:

      Our Lady Peace, Healthy in Paranoid Times (Columbia)
      Van Zant, Get Right with the Man (Columbia)
      Switchfoot, Nothing is Sound (Columbia)
      The Coral, The Invisible Invasion (Columbia)
      Acceptance, Phantoms (Columbia)
      Horace Silver Quintet, Silver's Blue (Epic Legacy)
      Dexter Gordon, Manhattan Symphonie (Columbia Legacy)
      The Bad Plus, Suspicious Activity (Columbia)

      almost like they are an extra subliminal warning, given the extra Sony "Bonus" that awaits on the CD.

  3. "Nothing for you to see here. Please move along." by KitesWorld · · Score: 5, Insightful

    bleh.

    Anyway, It's good to see this happening. It's important to make sure that the major labels realise that while DRM is legal, there are limits to what people will tolerate - and damaging peoples machines is not something that people are going to tolerate.

    Heck, with luck they might even water down Blu-Ray as a result. I can dream :)

  4. Great, yet another reason ... by LaughingCoder · · Score: 4, Insightful

    not to buy CDs. Like I needed more reasons. They are already too expensive and they force me to buy tracks I don't want just to get the 1 or 2 I want. I know Sony *thinks* they are *adding value* which will incent me to buy CDs, but obviously they miscalculated.

    If only someone would offer a digital download service with CD quality content.

    --
    The more you regulate a company, the worse its products become.
  5. Sony's DRM is Good by rudy_wayne · · Score: 3, Informative


    Install Sony DRM protected CD
    Re-Name your favorite CD ripping program to $SYS$filename.exe
    Now your CD ripper is hidden from Sony's DRM

    It can also be used to hide cheat programs from various games.

    1. Re:Sony's DRM is Good by Motherfucking+Shit · · Score: 2, Informative
      Install Sony DRM protected CD
      Re-Name your favorite CD ripping program to $SYS$filename.exe
      Now your CD ripper is hidden from Sony's DRM
      Maybe you missed the story from a few days ago where it was indicated that Sony's spyware can see through veiled attempts to use files whose names begin with $sys$.

      On the other hand, intentionally infecting oneself with this spyware in order to avoid other companies' DRM is simply genius, and is a sweet example of how multiple companies' competing DRM schemes will never be successful. Sony's DRM has made it possible to cheat in at least one MMORPM without recourse.
      --
      "BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
    2. Re:Sony's DRM is Good by Anonymous Coward · · Score: 4, Informative

      Actually renaming the ripper does NOT work, at least not consistently, according the original "discoverer" of this. See the last Slashdot story about it.

      Besides, you still have their shitty security-compromising, phone-homing, CPU cycle eating rootkit installed! So what if there's some way of working around it to rip the CD, it needs eradicating completely or better yet to not be installed to begin with.

      Better method :
      - Disable autorun, or hold down shift whilst you insert and explore the CD
      - Run ripper as normal, the rootkit isn't installed so there's nothing it can do

      Best method :
      - Don't buy the "CD" to begin with, write to the artist and Sony telling them why.

      Yeah, it's being used to cloak several cheat programs like the WoW auto-fisher. If I were head of one of their publishers I'd have my team of vicious attack lawyers looking for some legal grounds to sue Sony for loss of earnings / financial harm, I know there probably there aren't any but it's worth a try.

  6. no problem sony! by MagicMerlin · · Score: 5, Funny

    Just rename your emailed copy of the lawsuit to $sys$lawsuit.pdf and it will disappear!

  7. The mp3's have no DRM by psergiu · · Score: 5, Insightful

    I used to buy a lot of music CDs. But after this wave of incompatible discs i just resorted to download mp3s as its sure that i can play them on whatever device i want.

    --
    1% APY, No fees, Online Bank https://captl1.co/2uIErYq Don't let your $$$ sit in a no-interest acct.
  8. By the way, here's another interesting tidbit... by Hitto · · Score: 5, Interesting

    Before this gets /.ed, here's the text.
    Quoth the EFF :
    Now the Legalese Rootkit: Sony-BMG's EULA
    November 09, 2005

    If you thought XCP "rootkit" copy-protection on Sony-BMG CDs was bad, perhaps you'd better read the 3,000 word (!) end-user license agreement (aka "EULA") that comes with all these CDs.

    First, a baseline. When you buy a regular CD, you own it. You do not "license" it. You own it outright. You're allowed to do anything with it you like, so long as you don't violate one of the exclusive rights reserved to the copyright owner. So you can play the CD at your next dinner party (copyright owners get no rights over private performances), you can loan it to a friend (thanks to the "first sale" doctrine), or make a copy for use on your iPod (thanks to "fair use"). Every use that falls outside the limited exclusive rights of the copyright owner belongs to you, the owner of the CD.

    Now compare that baseline with the world according to the Sony-BMG EULA, which applies to any digital copies you make of the music on the CD:

    1. If your house gets burgled, you have to delete all your music from your laptop when you get home. That's because the EULA says that your rights to any copies terminate as soon as you no longer possess the original CD.

    2. You can't keep your music on any computers at work. The EULA only gives you the right to put copies on a "personal home computer system owned by you."

    3. If you move out of the country, you have to delete all your music. The EULA specifically forbids "export" outside the country where you reside.

    4. You must install any and all updates, or else lose the music on your computer. The EULA immediately terminates if you fail to install any update. No more holding out on those hobble-ware downgrades masquerading as updates.

    5. Sony-BMG can install and use backdoors in the copy protection software or media player to "enforce their rights" against you, at any time, without notice. And Sony-BMG disclaims any liability if this "self help" crashes your computer, exposes you to security risks, or any other harm.

    6. The EULA says Sony-BMG will never be liable to you for more than $5.00. That's right, no matter what happens, you can't even get back what you paid for the CD.

    7. If you file for bankruptcy, you have to delete all the music on your computer. Seriously.

    8. You have no right to transfer the music on your computer, even along with the original CD.

    9. Forget about using the music as a soundtrack for your latest family photo slideshow, or mash-ups, or sampling. The EULA forbids changing, altering, or make derivative works from the music on your computer.

    So this is what Sony-BMG thinks we should be allowed to do with the music on the CDs that we purchase from them? No word yet about whether Sony-BMG will be offering a "patch" for this legalese rootkit. I'm not holding my breath.
    Posted by Fred von Lohmann at 12:24 PM | Permalink | Technorati

    Endquote. It's interesting to see just how far Sony will go to alienate the tech-savvy user base. It's been a few years since I religiously started forbidding people to buy Sony products, because I wouldn't be assed to "fix my vaio, please" or to "take a look at my LCD screen, there are, like black dots and stuff on it", but my brother-in-law still got himself a Sony DAP.

    The first thing I thought was, "Wow! The salesman actually managed to sell him something that isn't an iPod.", but come on. What's you /.er's take on this vast DRM-wing conspiracy?

  9. Buying a new computer by BushCheney08 · · Score: 5, Interesting

    I know that Sony's actions here will make me think twice about buying a Vaio. I'm getting ready to buy a new laptop, and Sony does have some decent ones out there. However, I have no way of knowing that they're not gonna install this crap on the machine at the factory. Well done Sony. The actions of one arm are negatively affecting sales of another...

    --
    Be a real patriot: Question authority. Think for yourself. Formulate your own conclusions.
    1. Re:Buying a new computer by vivian · · Score: 2, Informative

      Don't do it.
      I bought a high end sony laptop (for £1900 in Aug 2001) and had no end of problems.
      Mobo died after 4 months, and the default warranty didn't cover it. ( I was in Aus, I bought it in the UK. So much for an "international" company, which was one of the reasons I bought the VAIO in the first place.)
      I git it repaired 7 months later on a return trip to the UK, leaving me with 1 month warranty.
      The screen backlight died 3 months later. Sony told me it would cost over AU$1000 to replace the screen (which is 16.1" UXGA 1600x1200 res), as the backlight and ascreen are all one unit.
      I eventually found a local guy in Sydney that could dissasemble the screen & replace the neon tube. Cost:200.

      I bought a mem upgrade, to kick ram up to 512Mb. 5 months later,I am back to 256Mb again - but it's not the ram, it's the second controller or something - both sticks work, when put in slot one.

      Oh, and this laptop was the *second* Vaio I bought. The first I bought from a reputable online shop in the UK. It arrived and died within 15 minutes of firing it up. I sent it back, only to find it would take 3 months to get my full refund, because Sony won't refund the vendor until they have done a full check etc. on the laptop themselves. I wasnt interested in getting it repaired - I just wanted a full refund, so I could go to a bricks and mortar shop and buy a different laptop that would actually work for more than 15 minutes before it had to be repaired under warranty. Unfortunately I still thought Sony was good, and that the first dodgy laptop was just bad luck.

      Get a dell or compaq or something. I hear they suck less.

    2. Re:Buying a new computer by Feyr · · Score: 2, Informative

      a friend in the computer repair business once told me that the vaios are so fragile they literally get hundreds of them to repair. that was about 2 years ago when i was shopping for a laptop.

      in the end i went for an eurocom. it's somewhat heavy, but does a damn good job

    3. Re:Buying a new computer by nahdude812 · · Score: 4, Informative

      Stay away from Dell too. After I was rear-ended in a car accident, my PCMCIA slot was damaged, but the machine worked fine otherwise.

      Of course that damage wasn't covered by my warranty, but the repair was covered by the other guy's insurance company. Their only clause for paying for it was this: any replaced parts needed to be shipped to them by me (I guess they wanted to make sure I wasn't trying to scam them and get myself a new computer).

      When I got the repair authorization from Dell, and fronted the $800 cost, I told the tech on the phone that I needed the replaced parts returned to me (the mobo needed to be replaced). He said no problem, I just needed to attach a note to the laptop, and they'd ship the parts back with the repaired laptop.

      I attached a note to the laptop to the effect (taped it securely to the back of the screen so it would be seen when the box was opened). After the laptop came back, it didn't have the old mobo, and the bill clearly stated that the mobo had been replaced. But there was no old mobo in the box.

      When I called support to ask about it, the first guy I talked to said Dell had a policy of never returning bad parts, but instead they destroy them in an environmentally friendly fashion. I explained I'd been told I could get the parts back, and needed the parts back to get reimbursed for it by insurance, he sent me to level 2. Level 2 said they do have a policy that they'll return those parts, but that I needed to tell the guy who issued my RMA in the first place. I explained I had done so, and he said, "I don't see any note on your RMA for that, you must not have done so, perhaps if you'd attached a note." I explained I had also attached a note, because that's what I was instructed to do by the RMA issuer. He checked the unpacking logs, and said no mention was made of a note.

      In the end I ended up talking to about a dozen different people in the returns area, almost every one had a different idea about how I'd have to have made sure I got the parts back, including some who told me that there's a 25% surcharge on getting the parts back (!).

      They wouldn't provide a partial or full refund for the work completed, they wouldn't ship me another mobo (I told them I didn't care if it was smashed into 100 pieces), and they didn't care that I was out the costs of this repair without the original parts. I climbed all the way up the supervisor chain to the director of out of warranty repairs, and no one cared, and no one was 1) willing to admit that any mistake had been made on their end (I had a PHOTO of the laptop in the shipping package, with my note attached to it, clearly readable, they claimed I could have done that after the fact), nor 2) willing to take any steps to placate me as an unhappy customer.

      So the insurance company wouldn't reimburse me, I spent $800 repairing a laptop that was not really worth that much (guess the insurance company should have totaled it), and it's all Dell's fault. They honestly didn't care.

      --
      Slay a dragon... over lunch!
    4. Re:Buying a new computer by duffbeer703 · · Score: 3, Informative

      Get an AMEX card, pay with it and dispute any nonsense like this with them, you'll likely get your money back.

      A body shop pulled a similar stunt with my car after I was in an accident. The repairs that they made were of poor quality, and the insurance company refused to do anything since I didn't tow the car 50 miles to the nearest authorized center.

      Fortunately, I charged it to my amex blue card, and wrote them a letter describing the situation in detail. There was some back and forth with the body shop, but the end result was a $3,000 chargeback which allowed me to get the shoddy work replaced.

      --
      Conformity is the jailer of freedom and enemy of growth. -JFK
    5. Re:Buying a new computer by dubbayu_d_40 · · Score: 2, Informative

      Wal-Mart and HP are rumored to be coming out with a $399 laptop this holiday season, and it actually sounds sweet (fyi, don't let AMD Sempron scare you, it is the Thoroughbred Athlon XP). You'll probably need to buy Windows seperately. Google has more details.

    6. Re:Buying a new computer by ad0gg · · Score: 3, Insightful

      Umm.. if its not your insurance company, you don't have to follow their rules. Remember it was the others guys fault. Its there responsibility to pay for the damages they caused, they should be the ones calling dell to get the old parts. They want to be dicks about it, i'd say i'm starting to have neck problems and tell them i'm seeing a chiropracter. They'll settle right on the spot.

      --

      Have you ever been to a turkish prison?

  10. More from Mark by Spad · · Score: 4, Interesting

    Looks like Sony aren't making it easy to get rid of their rootkit.

    Most Spyware has fewer hoops to jump through to uninstall it.

  11. Serves them right by Nerdposeur · · Score: 5, Interesting

    I'm not sure how Sony arrived at the decision to take over people's computers, but I can't see the morality of it. "People are stealing from us, so let's damage their property."

    In meatspace, this would be called "vigilante justice," but I'm not sure that large corporations qualify for that label.

    1. Re:Serves them right by brajesh · · Score: 5, Informative
      and they aren't even apologetic about it. From this piece of news-

      Thomas Hesse, President of Sony BMG's global digital business division, showed up on NPR to try and sweep the entire thing under the rug.
      "Most people, I think, don't even know what a rootkit is, so why should they care about it," he asked? "The software is designed to protect our CDs from unauthorized copying, ripping."

      Pathetic
      --
      95% of all sigs are made up.
    2. Re:Serves them right by pfrCalif · · Score: 4, Insightful
      That's a good quote, would be work well for my buddy:
      "Most of the girls I've been with don't even know what rapid spreading gonorrhea is, so why should they care about it?"
    3. Re:Serves them right by geoff+lane · · Score: 2, Insightful

      Did it work?

      Are Sony CDs distinquished by appearing less often on rips?

    4. Re:Serves them right by iainl · · Score: 3, Insightful

      Most division presidents don't even know what their precise bank balance is, so why should they care if a fraudster helps themselves to a couple of hundred?

      --
      "I Know You Are But What Am I?"
    5. Re:Serves them right by jedidiah · · Score: 2, Funny

      Even better:

              "Most girls don't even know what date rape is, so why should they care about it?"

      --
      A Pirate and a Puritan look the same on a balance sheet.
  12. Now they done it. by Somatic · · Score: 5, Funny

    You can piss off the consumers, the college kids, the geeks, the nerds, the haxx0rs, the artists, and even other people in the industry itself... but when you put that crap on a country CD, you just know some politician is going to buy it, and then you're screwed.

    --
    My script don't crash! She crashes, you crashed her!
    1. Re:Now they done it. by div_2n · · Score: 2, Insightful

      You can piss off . . . the geeks

      I know you are being funny, but this is just a REALLY bad idea for a company that produces technology driven products. Who do family members turn to when they are considering dropping money on expensive technology products for advice? I know mine turn to me. Guess what I'm going to say from now on when they ask? "Whatever you do, don't buy a Sony product." Mine listen to me implicitly when I give such direct advice especially if I have suggestions to offer.

      Sony has made a mistake of epic proportions. Watch their sales numbers. I bet dollars to doughnuts it takes a drammatic drop.

  13. Misleadings, expansions, and lawsuits abound by captainktainer · · Score: 5, Informative

    Several things are important to point out:

    First, right now it isn't "California" as a whole suing Sony. An attorney has filed a class action lawsuit, and California citizens (and the world as a whole) will benefit. It would be nice if the California Attorney General would lend the government's support in an amicus curiae brief, but in media-rich California that isn't likely to happen. The representatives of the people of California haven't really weighed in on the matter yet, sadly.

    Second, a New York law firm will be next to join the bandwagon. Things are heating up faster than the article summary indicates

    Third, all of these lawsuits are going to hit Sony *hard*, right in the wallet. Any financial benefit they might have gained from their DRM will be lost unless the lawyers involved immediately drop their cases.

    Finally, Sony really doesn't have any solid defense against the charge that they violated the Consumer Protection Against Consumer Spyware Act, *unless* the act specifies that spyware can only be classified as such if it submits personally identifiable information back to the authors or a third party. I'm not too clear on that regard- anyone have information they can add on that count?

    1. Re:Misleadings, expansions, and lawsuits abound by mccdyl001 · · Score: 3, Informative

      Actually, the sony media player does send back personal information - it checks for the latest lyrics and album art for any CD you play through it. So at the least they can collect CD being played, time of day and IP address of computer playing it. That to me is spyware..

    2. Re:Misleadings, expansions, and lawsuits abound by Phreakiture · · Score: 2, Interesting

      Second, a New York law firm will be next to join the bandwagon. Things are heating up faster than the article summary indicates

      This is more important than you think.... Looking back to an earlier post, where the EULA was quoted, we have this:

      THE VALIDITY, INTERPRETATION AND LEGAL EFFECT OF THIS EULA SHALL BE GOVERNED BY, AND CONSTRUED IN ACCORDANCE WITH, THE LAWS OF THE STATE OF NEW YORK APPLICABLE TO CONTRACTS ENTERED INTO AND PERFORMED ENTIRELY WITHIN THE STATE OF NEW YORK (WITHOUT GIVING EFFECT TO ANY CONFLICT OF LAW PRINCIPLES UNDER NEW YORK LAW). THE NEW YORK COURTS (STATE AND FEDERAL), SHALL HAVE SOLE JURISDICTION OF ANY CONTROVERSIES REGARDING THIS AGREEMENT; ANY ACTION OR OTHER PROCEEDING WHICH INVOLVES SUCH A CONTROVERSY SHALL BE BROUGHT IN THOSE COURTS IN NEW YORK COUNTY AND NOT ELSEWHERE.

      So, as you can see, we here in New York have the ability to toast this thing.

      At this point, because all of the legal boilerplate that Sony put in is in all caps, I am going to just blather on for a bit because Slashdot's fucking lameness filter kicked in. It really sucks that I can't get a legitimate post through. Really. I honestly had a solid point, but the lameness filter is, well, lame.

      --
      www.wavefront-av.com
  14. Well, how's this for irony? by Chibineko · · Score: 3, Funny

    From the list of Infected CDs:
    Our Lady Peace, Healthy in Paranoid Times

    Hrmmm....

  15. Aim at foot, pull trigger by Dekortage · · Score: 4, Informative

    From the article: "Sony's move is the latest effort by the entertainment companies to rely on controversial 'digital rights management' (DRM) technologies to reverse a steady drop in sales that the industry attributes in large part to piracy facilitated by online music and movie file-sharing networks like Kazaa and Limewire."

    Yeah, because installing secretive, privacy-invading software on your computer is sure to stimulate CD sales.

    And the uninstall process is a privacy invasion too... you gotta fill out an online form, check your email for a URL to ANOTHER online form, then get the uninstaller. And while the uninstaller gets rid of the XCP2 Aurora, it simultaneously installs another DRM (MediaJam). Nice. Sony, how I love thee. You're so sinister.

    --
    $nice = $webHosting + $domainNames + $sslCerts
    1. Re:Aim at foot, pull trigger by doublem · · Score: 2, Interesting

      Well, there go my plans to buy a PlayStation 3.

      Guess I'll get the next Nintendo Game Cube instead.

      --
      "Live Free or Die." Don't like it? Then keep out of the USA
  16. Boycotting DRM *forever* by snotclot · · Score: 2, Insightful

    I wonder if whichever genius Sony/BMG exec did this is fired already... surely the other Sony branches love this publicity. Do people think this will eventually harm or even dent Sony's brand image? As a fellow computer saavy user here on Slashdot I'm already trying to actively, personally boycott Sony and any company that is bent on using DRM. And you guys say, what if Intel and AMD both DRM there chips? Surely, I can't boycott computers in general can I? But there HAS to be a few clever electrical and computer engineers out there who will make a new company *specifically* to have non-drm chips. Sure, it costs millions in R&D. But at the time that DRM is in chips making a retro x86 compatabile CPU that can be fabbed in Taiwan/China shouldn't be too hard should it?

  17. Did you look at the list of "protected" CDs? by Weatherman-au · · Score: 5, Funny

    I mean, come on, Sony! Celine Dion? Neil Diamond? Ricky Martin??

    If you were really serious about XCP as a means to prevent illicit copying, in order to protect your revenue, how about applying it to music that people would want to download?

    1. Re:Did you look at the list of "protected" CDs? by xtracto · · Score: 2, Interesting

      Sure, you may think that music is really crapastic, but the reallity is that those artists are the ones that get the into the billboard 10 and get the platinium, titanium, uranium etc prizes for disc selling.

      Of course, one could argue that, people which know how to actually copy CD's are the ones that do not listen to that music (i.e. the not average J6Pack). But, some of them use their knowledge to pirate & sell the illegal copies. I presume (*I hope*) those are the persons which sony was aiming when applying this (or any other) kind of DRM security.

      Now, they really messed it when they blocked the ability to copy the music to the iPod since it is one 100% legit use of a ripper/mp3-encoder (Kudos go to Apple on this) and it is very, very, VERY widespread.

      I would really love to see some of these lawsuits continue until a nice end. I hope this serves as the spark that was needed to show the USA people how invaded your privacy is. And how have your government took your rights and introduced them into i-dont-tell-you-where.

      As some other slashdotter said before, USA citizens are lazy, they wont be pissed off about something until it trasspases their "lazzyness-level", the cable-with-advetisments, the game-consoles-without-chips, the DMCA, etc etc...

      I have been monitoring this Sony matter for some days, and I am glad to see it has escalated in the SciTech Google news section, from an obscure search "intitle:Sony intitle:DRM" to a 3rd place in the list (just suprassed by bill gates self-leaked memo and some other digital election thing".

      If the correct people (we) make things correctly, this could be that spark that we needed to shake those lazy sixpackers that are staring at the TV or at hallmark.com

      --
      Ubuntu is an African word meaning 'I can't configure Debian'
  18. Serious work issue by RoboProg · · Score: 3, Insightful

    This poses a potential problem for me, as I like to listen to my CDs at work (ripped to MP3 format, of course). Security is a real issue at work, to their credit. I can't have my music installing spyware on my employer's PC.

    HELLO SONY! You are making your stuff unusable! Cease & desist, and all that.

    --
    Yow! I'm supposed to have a plan?
    1. Re:Serious work issue by RoboProg · · Score: 4, Interesting

      Never mind: I see one of the other posters has kindly provided the EULA, which says I can't listen to (what otherwise would have been) my music at work anyway.

      Problem "solved"

      Caveat emptor! (read label, avoid zombie un-CDs)

      --
      Yow! I'm supposed to have a plan?
  19. mod parent up by TheNationalist · · Score: 2, Informative

    The summary is completely misleading and would have a casual reader believe that the Attorney General of California is suing Sony. This is merely a class action lawsuit by some lawyer on behalf of California citizens.

    --
    Check out this guy's BZFlag cheat client!
  20. Nice list of CDs.. by Anonymous Coward · · Score: 2, Informative

    Trey Anastasio, Shine (Columbia)
    Celine Dion, On ne Change Pas (Epic)
    Neil Diamond, 12 Songs (Columbia)
    Our Lady Peace, Healthy in Paranoid Times (Columbia)
    Chris Botti, To Love Again (Columbia)
    Van Zant, Get Right with the Man (Columbia)
    Switchfoot, Nothing is Sound (Columbia)
    The Coral, The Invisible Invasion (Columbia)
    Acceptance, Phantoms (Columbia)
    Susie Suh, Susie Suh (Epic)
    Amerie, Touch (Columbia)
    Life of Agony, Broken Valley (Epic)
    Horace Silver Quintet, Silver's Blue (Epic Legacy)
    Gerry Mulligan, Jeru (Columbia Legacy)
    Dexter Gordon, Manhattan Symphonie (Columbia Legacy)
    The Bad Plus, Suspicious Activity (Columbia)
    The Dead 60s, The Dead 60s (Epic)
    Dion, The Essential Dion (Columbia Legacy)
    Natasha Bedingfield, Unwritten (Epic)
    Ricky Martin, Life (Columbia)
     
    Apart from Celine and The Coral, I've never heard of any of them. Maybe they should spend money on trying to market and sell these, rather than trying to piss people off?
     

    1. Re:Nice list of CDs.. by theurge14 · · Score: 2, Funny

      There's no harm in not knowing who Trey Anastasio is (lead singer/guitarist of Phish), but not being able to acknowledge the greatness that is Neil Diamond and Ricky Martin frightens and confuses me.

  21. DMCA defense? by hrm · · Score: 5, Insightful

    I hope this goes to court and triggers Sony into mounting an DMCA based defense ("this is our copy protection system, and you don't mess with that shit even if does screw your PC"), then maybe people would get a better understanding of what a rotten law the DMCA actually is.

  22. Comment removed by account_deleted · · Score: 2, Insightful

    Comment removed based on user account deletion

  23. in similar news by coredump-0x00001 · · Score: 5, Informative

    Pestpatrol ad/spyware remover now detects and removes sony's DRM rootkit hats off to eTrust for that.

  24. For Everything Else There's... by Bad+to+the+Ben · · Score: 5, Funny

    - DRM rootkit to stop piracy: $50,000,000
    - Patch to water-down DRM rootkit: $5,000,000
    - Top notch lawyers to sue pirates: $100,000,000
    - Being sued by the only legitimate users you have: Priceless.

    There are some thought processes money can't buy. For everything else there's MasterTard (tm).

  25. I see stupid people. by Phoenix · · Score: 4, Insightful

    And people wonder why I haven't bought a single CD in the past 5 years that didn't come from an independant artist. Sony will just have to lable me as a heathen devil commie mutant anti-social pirating slime bag since I now get all my music from other sources besides the traditional record industry. First it was a copy protection that killed my CD-Rom drive and my Car Stereo, now we have a major company turning into a @#$%ing hacker with intent on screwing up my system just to keep me from using thier music in THIER OWN MP3 PLAYER.

    Yes, I love the fact that Sony wants to sell me a MP3 player and MP3 compatable CD and DVD players, but doesn't want me to actually USE the damn things to listen to thier music.

    Go Figure.

    The other stupid thing is the simple fact that there is no copy protection that has lasted more than 2 weeks before it was cracked, and at times in the most embarrasing way imaginable.

    The one that cost millions to develop and was cracked using a $1.25 Sharpie marker jumps to mind.

    Frankly I hope the music industry dies. I'm just so utterly sick to death about the whole goddamn thing I want it gone.

    Phoenix

    --
    -- Wiccan Army, 13th Airborne Division "We will not fly silently into the night"
  26. I actually bought one of these... by OolonColluphid · · Score: 3, Informative

    ... and the part I love best is that I actually need to rip the thing before it wrecks my CD player. I bought the "DualDisc" version of the Trey Anastasio CD they show in the EFF write-up. Every time I put it in my 10 year old Sony CD player, it makes a horrible racket. One of my friends is having trouble playing it in his portable because it's so thick that it's brushing the lid. I'm afraid to put it in the car disc player for fear that it will get stuck.

    Besides putting a personal ban on buying any more Sony junk, and doing my best to avoid buying any albums on their label, I will also be writing to the artist and urging others to do the same.

    1. Re:I actually bought one of these... by Red+Flayer · · Score: 4, Funny

      "I bought the "DualDisc" version of the Trey Anastasio CD they show in the EFF write-up. Every time I put it in my 10 year old Sony CD player, it makes a horrible racket."

      Funny, same thing happens when my wife plays the Celine Dion CD. But I think in my case, the horrible racket is the intended output.

      --
      "Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
  27. ALCEI claims rootkit is a virus by swissfondue · · Score: 5, Interesting
    As linked through other Slashdot posts, the ALCEI (the Italian Electronic Frontiers organization) http://www.alcei.org/index.php/archives/105, has a different tactic. They refer to F-Secure http://www.f-secure.com/v-descs/xcp_drm.shtml in order to sue Sony for propagating a virus named "XCP DRM Software".

    This opens another plan of attack which I think will have more chance of succeeding (at least for public mind-share. I can't judge the legal value of the argument).

    --
    Rubies and Pearls are not what you think.
  28. Re:"Nothing for you to see here. Please move along by Dogtanian · · Score: 4, Insightful

    t's important to make sure that the major labels realise that while DRM is legal, there are limits to what people will tolerate - and damaging peoples machines is not something that people are going to tolerate.

    It's not simply a question of tolerance or not; some DRM may be "legal", but (IANAL) installing a root-kit on someone's machine without notification or permission almost certainly isn't. If they get away with this, it'll be because they have better lawyers, not because by any reasonable judgement it is "legal".

    Of course, I hope it kicks up a stink for Sony too, but that's beside the point.

    --
    "Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
  29. Correction: by GungaDan · · Score: 5, Funny

    $sys$woohoo... ;-)

    --
    Eloi are stupid, throw morlocks at them!
  30. Two thoughts by BigPoppaT · · Score: 3, Interesting
    1) In organizations where security/privacy is mandated (due to HIPAA, SOX, and other legislation) I expect the ISOs (Information Security Officers) will begin prohibiting the use of audio CDs in PCs. This will probably help Sony's competitor Apple more than it will help Sony, because it will drive iPod sales.

    2) Here's a link where you can communicate to Sony how you feel about the rootkit situation. I used this link to send the following to Sony:
    I want you know that I will never purchase any Sony product again until: a) the VP who approved your rootkit is fired; and b) Sony promises not to do anything like this again. I have never pirated a CD, and I use Linux (so this rootkit would not affect me), but you have effectively declared war on your customers. So, I will refuse to be one of your customers from now on. I am giving you this feedback because I wanted you know why I am boycotting you. I believe that Sony should be accountable for its actions.
    I didn't submit this anonymously. Here is the email reply they sent me (pretty much a form letter):
    Thanks for visiting Sony Music Online and for your feedback. We appreciate (and encourage) all suggestions and comments. As you can imagine, we receive quite a few email messages every day. While we would like to respond to each of them individually, we often do not have the time and resources to do so. Be assured that I will pass your comments on to the parties most responsible for dealing with them. Have you checked out our FAQ page? Perhaps you will be able to find the answer to your questions there: http://www.sonymusic.com/help/faq/ Thanks again for your note and the time spent on Sony Music Online.
    The most helpful thing about the faq was seeing which record labels are Sony. Unfortunately, Columbia Records is one of them - so I won't be buying the new System of A Down album when it comes out in a couple of weeks. That hurts, but in good conscience I just can't do business with Sony. If people buy Sony products in spite of this, Sony wins. So, no System CD for me, no PS3 for you gamers, no Vaio for you Mac-wannabes, etc. Don't just complain - let them know why you're boycotting, then actually do it.
    1. Re:Two thoughts by mochan_s · · Score: 2, Interesting

      Dude, I used to be like you - only 5 years ago shifted. It was Tom was pissed that Napster users got kicked out for downloading their album tracks, and Zach did that and all.

      Now, Tom is a fat sell-out on Audioslave and who knows where Zach is.

      My point is how can you even trust someone whose music is being peddled by Sony? They're in the same list as Celine Dion and Van Zant.

  31. Not only it is Lame, it contains.... by onkl · · Score: 3, Interesting

    In Dutch newslogs, it is mentioned now that the rootkit is using parts of the (LGPL) LAME-encoder. So, should their rootkit be open-source then? "Script kiddies unite, fight for your source code rights" I'd fear. Below some babelfished Dutch. (from Webwereld.nl) Thursday 10 November 2005, 09.59 - the spyware which Sony on the computers of muziekfans install do not seem not only technical, but even also copyright in the hook. In the rootkit pieces code appear sit which is identical to LAME, open source mp3-encoder. The licentie is exceeded. Concerning software exercises the copyright with the so-called Lesser Gnu Public License (LGPL). According to this licentie Sony must satisfy requirements to a number of. Thus they must tell that they use software in a copyright notice. Also the company the source code of open-sourcelibraries must provide or available to make. Finally the tussenvorm between must make source code and feasible code, the so-calledobject traffic-jams, meeleveren or available, with which others can make similar software. Sony have only satisfied to none of these requirements, but provide a feasible programme. A computer expert, of whom the name is confessed at the redactie, discovered that on the cd Get Right With The man of Van Zant strings from the library version.c of Lame sits. This is make up from the string: "http://www.mp3dev.org/", "0.90", "LAME3.95", "3.95", "3.95". But the expert has more proof. This way there so-called array largetbl sit at a place in the programme go.exe. This is a part that is used in the module tables.c of libmp3lame. The discovery is possible far-reaching consequences has on the muziekgigant, which themselves claim only protect the copyrights. Rather judges in Germany forced several companies already make the source code public and the required spullen for compiling to provide. Also it is possible claim damageses. Meanwhile details also other become clearly and this way complain the Electronic frontier foundation which the spyware make also legal listening music on iPods impossible. The organisation is busy with a list of cd's which publishes hidden programmatuur meeleveren to make and these on the Internet site. Wouter Rutten of the NVPI emphasise that the commotie for Dutch a ' meaningless tale ' is because the aware cd's are only in the United States and in Mexico available. The organisation offers information on the beveiliging of First 4 Internet to Cdlogo.nl by means of the site, however. Several phone calls to SonyBMG continued call back in spite of promises to unanswered.

    1. Re:Not only it is Lame, it contains.... by Intron · · Score: 4, Informative

      Can I use LAME in my commercial program?

      *** IMPORTANT NOTE ***
      The decoding functions provided in LAME use the mpglib decoding engine which is under the GPL. They may not be used by any program not released under the GPL unless you obtain such permission from the MPG123 project (www.mpg123.de).

      --
      Intron: the portion of DNA which expresses nothing useful.
    2. Re:Not only it is Lame, it contains.... by zerocool^ · · Score: 2, Informative


      *sigh*

      As has been pointed out before, the static strings that are compiled into the program are just parts of the program that are LOOKING FOR LAME. It doesn't have any part of lame in it, it's making sure that you don't use lame to encode this CD. It's part of the so-called "protection". It's looking for a whole list of files and applications that it knows about in order to prevent them from being used to extract the audio from this CD.

      No LGPL violation. Move along.

      --
      sig?
  32. Re:"Nothing for you to see here. Please move along by Jarnis · · Score: 5, Informative

    If you want to see how the 'logic' of Sony works, see this patent;

    http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PT O2&Sect2=HITOFF&u=/netahtml/search-adv.htm&r=1&p=1 &f=G&l=50&d=ptxt&S1=(Kutaragi.INZZ.+AND+Sony.ASNM. )&OS=in/Kutaragi+AND+an/Sony&RS=(IN/Kutaragi+AND+A N/Sony

    For short version, see this story;

    http://www.joystiq.com/entry/1234000420067137/

    (Sony is patenting a method for games console discs to be tied to the console unit they're first ran on. No second hand game sales or loaning of games...)

  33. Copyright infringement? by Anonymous Coward · · Score: 5, Interesting

    According to this article (Dutch) on the CD Get Right With The Man of Van Zant there are strings from the library version.c of Lame. The following strings are found: "http://www.mp3dev.org/", "0.90", "LAME3.95", "3.95", "3.95 ".

    Also in the program go.exe their is an array called "largetbl", which is part of tables.c of libmp3lame. Can anyone confirm these findings?

    LAME is licenced under the LGPL. Could this mean more trouble for Sony because of a license violation?

    1. Re:Copyright infringement? by Anonymous Coward · · Score: 2, Informative

      i cant see why that would constitute a LGPL violation simply because they did not copy anything other than an identification string. it is a version number or a tiny bit of info (also not for the purpose of executing it, but for identification (and not a derivitive work)

      i hate the rootkit, but the LGPL shouldnt have that much power over this situation.

  34. Now it's safer to Pirate? by concord · · Score: 2, Insightful

    I find it interesting that Sony has violating consumer's rights in order to protect their own rights. Now for the first time it is actually safer to download and listen to pirated music then it is to purchase and use compact disks and dvds. Piracy will become a matter of self-preservation.

    Also, the new shadowy status of $sys$ prepended files opens the door for all kinds of malware - these programs will use this "hole" to create hidden processes on people's home and workplace computer systems - a serious security threat to all the nations of the world. In essence Sony has facilitated a whole new class of malware, virus and worm propagation by assisting them in denying detection.

    Being sued should be the least of Sony's worries.

    --
    MFG: "The system supports both the LAMP (Linux, Apache, MySQL, PHP) and WIMP (Windows, IIS, MySQL, PHP) platforms."
  35. Get Immunity! by ajs318 · · Score: 2, Informative

    The sad thing is that this "DRM" doesn't actually accomplish anything except false description, trespass to chattels bordering on criminal damage, misuse of a computer and aiding and abetting criminal damage and misuse of a computer. And it only manages to rack up that charge sheet under Windows!

    Quick way to get around it: boot up a copy of Slax using the cheatcode slax copy2ram, swap the CD, cd into your hard disk {it'll be under /mnt somewhere} and you can then use # cdparanoia -B to rip off the audio tracks with no problem. You can even go
    # for i in *wav; do lame -h $i; done
    or
    # for i in *wav; do lame -h $i && rm $i; done
    if you don't care about keeping the wav files.

    --
    Je fume. Tu fumes. Nous fûmes!
  36. Suspicious Activity by digitaldc · · Score: 2, Funny

    How ironic that one of the copy-protected CDs is titled 'THE BAD PLUS' by Suspicious Activity.
    And they really mean it!
    Be rest assured Sony, that I will NEVER buy one of your invasive CDs.

    --
    He who knows best knows how little he knows. - Thomas Jefferson
  37. Re:No more DRM discs from Sony! by malchus842 · · Score: 3, Insightful

    and just in California

    Except that CA is so huge that to market a disc in CA that was different than the rest of the US just wouldn't be worth the cost. Especially since CDs are bought online, etc. No, if CA wins, Sony will end up dropping THIS particular DRM method. And others will be less likely to do something like it.

    Also, CA isn't the only state with such consumer protections. Others will follow suit if this one works, or even before.

  38. The end of democracy by tomcres · · Score: 3, Insightful

    The California suit is really nothing when you look at the big picture. The reality is that we have surrendered our freedom, in fact, surrendered our supposedly democratic government, to rich people with capital interests in restricting our liberty. A lot of this has to do with the invention of incorporation, the idea that a company can be viewed as a "person" under the law. But just take a look at who makes up our government and what kind of laws they enact. You almost have to be a millionaire political party contributor or fundraiser to be nominated for office, and once in office, the politicians are not representing the will of the people, but the will of the lobbyist and big money contributors. If laws like DMCA or any other copyright or patent legislation were put to public referendum, they'd be defeated _easily_. However, because RIAA and MPAA and their associates put billions of dollars into the Republicans' and Democrats' pockets, they enact legislation that absolutely no one outside of those industries wants!

  39. Howto: Get an apology from Sony.. by wraith0x29a · · Score: 2, Insightful

    Take the word 'Sony', slice the 'n' vertically down the middle and flip the right-hand half on it's vertical axis - you'll end up with the word 'Sorry'.

    After their response to my e-mail complaint when this issue first arose it's the only apology anyone can expect from them. Oh well, I use Linux anyway and all the CDs on the blacklist are either utter pish or by people I've never heard of but, still, the whole thing stinks like 3-week old Sushi.

    --
    ~ Better a freak than a sheep. ~
  40. Sony not found for comments... by Anonymous Coward · · Score: 5, Funny

    ...as they have renamed themselves to $sys$Sony...

  41. Re:Yeah, but... by Anonymous Coward · · Score: 3, Informative

    IANAL

    As I recall my Business Law textbook stating "the court frowns on disclaimers of responsibility". You see such disclaimers all over the place, signs on stores and parking lots, purchase agreements, and eulas. However there is established criteria that a company or private owner must apply due diligence to make sure their actions/product do not injure others and is generally determined in court by the "reasonable man" test. "Injure" includes not only physical injuries to persons but financial, reputation etc "injuries".

  42. Exploit claimed for Sony rootkit by andyo · · Score: 4, Informative
    The BitDefender company claims an exploit has already been found that uses the Sony DVD rootkit to gain access to one's system:

    http://www.bitdefender.com/VIRUS-1000058-en--Backd oor.IRC.Snyd.A.html

    Naturally, they are promoting their software as protection.

  43. Oh, to be a lawyer by hey! · · Score: 5, Interesting

    IANAL, but I would love to be the one kicking the shit of out this EULA.

    Suppose you sign a contract with me in which for $100 I promise to fix things so your neighbors stop complaining about your dog barking at night. We agree in our contract that you will limit my liability from anything resulting from my attempts to stop Fido from barking to $50. I then drive up to your house and put a bullet through Fido's head.

    Now, does any person reasonably believe that you authorized me to shoot your dog, even if it's the most convenient way to accomplish what I said I'd do? Does any person reasonably beleive that consumers authorized Sony to completely undermine the security of their systems?

    Or how about this: I agreed to limit any damage due to my use of Sony's software, but my system crashed as a result of my placing a Deustche Grammaphone CD in the drive. That wasn't my use of Sony's software, that was Sony's use of Sony's software to check up on me. Or my system is compromised by a hacker. That wasn't my use of Sony's software, that was the hacker's use of Sony's software. And don't say I promised not to hold you responsible for negligence. This isn't negligence it's misrepresentation. This is not "YOUR USE OF ANY OF THE LICENSED MATERIALS"; nor is it "THIS EULA" (see point above).

    Sony should just own up to the fact this was incredibly stupid and irresponsible rather than bulling ahead and piling up liability for itself. Even at $5.00 a CD, it's going to hurt when the hammer drops. They should offer to replace all existing CDs with this software and provide technical support for one year to users who are affected by it.

    --
    Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
  44. Re:this sounds like a job for microsoft security by Grave · · Score: 2, Interesting

    I disagree. I think Microsoft would love nothing more than to issue a patch removing something from Sony. The amount of PR and publicity this would create two weeks before launching a product that directly competes with Sony's only real moneymaker would be worth far more than costs of a possible lawsuit that Sony might attempt to launch against them (which would get thrown out anyway).

  45. Re:By the way, here's another interesting tidbit.. by mrchaotica · · Score: 2, Funny

    I'm really torn on this, because I want to forbid my girlfriend from buying any more Sony products (I personally have been boycotting them for years already -- their hard-on for proprietary formats (e.g. Memory Stick) was enough for me), but I know her family really likes gaming, and buys every console that comes out.

    I hate to do it, but I may have to issue the ultimatum "Do not buy a Playstation 3, because I will be forced to break up with you if you do."

    --

    "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

  46. Re:"Nothing for you to see here. Please move along by 192939495969798999 · · Score: 2, Insightful

    So within a few weeks, someone will have a machine that when you put the protected disc in, it copies it on the first run and removes said flags. Sony will in effect build an even stronger incentive to hack and hack well. If you can pull it off, you'll be the hero beating evil Sony's "run once, run nowhere else" strategy, plus you'll be a great coder who wrote software that has to work right the first try.

    --
    stuff |
  47. Re:By the way, here's another interesting tidbit.. by flatface · · Score: 2, Informative

    You seem to have forgotten Blizzard vs. bnetd.

  48. implementation? by Ender+Ryan · · Score: 2, Interesting
    I just cannot see Sony actually implementing this nonsense. I can't even imagine how many people would be turned away by that.

    Well, that'd be a surefire way to get Microsoft to succeed in Japan :)

    --
    Sticking feathers up your butt does not make you a chicken - Tyler Durden
  49. sony hits Macs too! by Anonymous Coward · · Score: 4, Interesting

    From Macintouch today:

    A reader followed up on the discovery that Sony was playing a dirty trick on its customers, secretly installing a malware-style "root kit" on their computers via audio CDs:

    I recently purchased Imogen Heap's new CD (Speak for Yourself), an RCA Victor release, but with distribution credited to Sony/BMG. Reading recent reports of a Sony rootkit, I decided to poke around. In addition to the standard volume for AIFF files, there's a smaller extra partition for "enhanced" content. I was surprised to find a "Start.app" Mac application in addition to the expected Windows-related files. Running this app brings up a long legal agreement, clicking Continue prompts you for your username/password (uh-oh!), and then promptly exits. Digging around a bit, I find that Start.app actually installs 2 files: PhoenixNub1.kext and PhoenixNub12.kext.
        Personally, I'm not a big fan of anyone installing kernel extensions on my Mac. In Sony's defense, upon closer reading of the EULA, they essentially tell you that they will be installing software. Also, this is apparently not the same technology used in the recent Windows rootkits (made by XCP), but rather a DRM codebase developed by SunnComm, who promotes their Mac-aware DRM technology on their site.

    so, Mac users have been safe up 'til now......

  50. A EULA is a Contract? by computer_redneck · · Score: 3, Interesting

    If this is so, isn't the law of the US that Children under 18 are not legally bound or able to enter into a contract with anyone without permission of the parent? If this is so and a EULA is a Contract then technically doesnt that mean that anyone under the age of 18 in the US is not bound by the EULA?

    Just curious.

    --
    "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." - BF
  51. A Lawsuit? by KGB+is+My+Name · · Score: 2, Funny

    A Lawsuit? Where, when and how do I sign up???

  52. Re:Boycotting DRM *forever* - EBAY! by Nom+du+Keyboard · · Score: 3, Informative
    But there HAS to be a few clever electrical and computer engineers out there who will make a new company *specifically* to have non-drm chips.

    There are already 10's of millions of non-TPC computers in the world. You should be able to live the rest of your life buying cheap used computers off of eBay to use.

    --
    "It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
  53. Re:Why all the attention on Sony? by earache · · Score: 3, Informative

    It doesn't require auto-run to be disabled or enabled. You have to use the media player software that comes on the CD to play the CD.

    PS. iTunes for Windows will turn on auto-run if you have it disabled.

  54. I didn't agree to the EULA if my wife plays a CD by vinn01 · · Score: 3, Interesting

    My wife might have played one of these Sony CDs on our computer. I didn't agree to the Sony EULA. But I'm the one who will have to spend my time cleaning up Sony's mess.

    That is one point that I've never seen a good answer to: On PC's used by more than one person, there is only one person that "agreed" to the EULA.

    How can the EULA be applied to the other users who may not even know that the EULA exists (let alone what is says)?

    Anyone? Anyone? Bueller?

  55. Let's use it against them! by koma77 · · Score: 3, Funny

    Why not record a bunch of crappy songs, burn them on a CD and send them for review to SONY. And, of course, just to make sure they don't copy it illegally, let's fill the CD with our OWN rootkit/spyware/phone-home/whatever! Let 'em have it! And a EULA the size of the yellow pages...

  56. Re:By the way, here's another interesting tidbit.. by SeattleGameboy · · Score: 4, Interesting
    It is even worse than that.

    http://news.com.com/Antivirus+firms+target+Sony+ro otkit/2100-1029_3-5942265.html?part=rss&tag=594226 5&subj=news

    Excerpts:

    However, Computer Associates, which has a security division, said on Monday it had found further security risks in the Sony software and was releasing a tool to uninstall it directly.

    According to Computer Associates, the Sony software makes itself a default media player on a computer after it is installed. The software then reports back the user's Internet address and identifies which CDs are played on that computer. Intentionally or not, the software also seems to damage a computer's ability to "rip" clean copies of MP3s from non-copy protected CDs, the security company said.

    "It will effectively insert pseudo-random noise into a file so that it becomes less listenable," said Sam Curry, a Computer Associates vice president. "What's disturbing about this is the lack of notice, the lack of consent, and the lack of an easy removal tool."

    So, not only is it spying on you, it even prevents you from making good copies of the CD's WITHOUT any DRM!!! The BALLS!

  57. Re:I didn't agree to the EULA if my wife plays a C by vinn01 · · Score: 2, Interesting

    ...you are accepting responsibility for their actions.

    No, I'm not.

    I think that your analogy is wrong. It's more like if my wife gets caught speeding in our (community property) car. I don't get a ticket. I don't agree to show up in court. She has to accept responsibility for her actions. I am not bound by any agreement that she makes (Like: "Yes, officer I'll slow down...").

    That is closer to the EULA that she agrees to on our (community property) computer. I don't know if an agreement was offered/made. And I have no idea what the contents of the agreement is. How does any court figure that I'm bound to the EULA?

  58. Re:All Right Class... by thc69 · · Score: 2, Funny
    Would the direction and speed of the wind make a difference in the 'safe' distance?
    No.
    Why?
    Because:
    (i.e. ignore aerodynamic effects).
    --
    Procrastination -- because good things come to those who wait.
  59. Re:I didn't agree to the EULA if my wife plays a C by WhiteKnight07 · · Score: 3, Interesting

    I've got an intersting queestion. Since these are music CD's it stands to reason that a good portion of them will be purchased by minors. (people under 18) Since minors can't legally agree to a contract or other legally binding agreement is the EULA enforcable if a minor buys the CD, puts it in there computer, and unknowingly hits "I agree."? Is the EULA simply not enforcable or are they technically not allowed to play the CD by virtue of not being able to agree to the lisence?

    --


    We're going to make information free Mr. Anderson, whether you like it, or not.